He did. That's what the "you aren’t forcing the user to manage raw tokens and secrets in plain text." bit comes in.